# golang.org/x/net (Go) vulnerabilities 40 known vulnerabilities (2 critical, 14 high, 11 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v0.62.0 (Oct 27, 2026): no advisory affects it - Newest unaffected release: v0.62.0 (Oct 27, 2026), the latest release - Releases: 62 since v0.1.0 (Oct 19, 2022) - Registry: https://pkg.go.dev/golang.org/x/net - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-97045: v0.1.0 to v0.61.0 (v0.62.0 is outside it) - CVE-2026-78661: v0.1.0 to v0.61.0 (v0.62.0 is outside it) - CVE-2026-97032: v0.1.0 to v0.59.0 (v0.60.0 is outside it) - CVE-2026-78663: v0.1.0 to v0.59.0 (v0.60.0 is outside it) - CVE-2026-78669: v0.1.0 to v0.59.0 (v0.60.0 is outside it) - CVE-2026-78660: v0.1.0 to v0.59.0 (v0.60.0 is outside it) - CVE-2026-78659: v0.1.0 to v0.59.0 (v0.60.0 is outside it) - CVE-2026-46600: v0.1.0 to v0.55.0 (v0.56.0 is outside it) - CVE-2026-27136: v0.1.0 to v0.54.0 (v0.55.0 is outside it) - CVE-2026-25681: v0.1.0 to v0.54.0 (v0.55.0 is outside it) - CVE-2026-25680: v0.1.0 to v0.54.0 (v0.55.0 is outside it) - CVE-2026-42502: v0.1.0 to v0.54.0 (v0.55.0 is outside it) - CVE-2026-39821: v0.1.0 to v0.54.0 (v0.55.0 is outside it) - CVE-2026-42506: v0.1.0 to v0.54.0 (v0.55.0 is outside it) - CVE-2026-33814: v0.1.0 to v0.52.0 (v0.53.0 is outside it) - CVE-2026-27141: v0.50.0 (v0.51.0 is outside it) - CVE-2025-58190: v0.1.0 to v0.44.0 (v0.45.0 is outside it) - CVE-2025-47911: v0.1.0 to v0.44.0 (v0.45.0 is outside it) - CVE-2025-22872: v0.1.0 to v0.37.0 (v0.38.0 is outside it) - CVE-2025-22870: v0.1.0 to v0.35.0 (v0.36.0 is outside it) - CVE-2024-45338: v0.1.0 to v0.32.0 (v0.33.0 is outside it) - CVE-2023-45288: v0.1.0 to v0.22.0 (v0.23.0 is outside it) - CVE-2023-39325: v0.1.0 to v0.16.0 (v0.17.0 is outside it) - CVE-2023-44487: v0.1.0 to v0.16.0 (v0.17.0 is outside it) - CVE-2023-3978: v0.1.0 to v0.12.0 (v0.13.0 is outside it) - CVE-2022-41723: v0.1.0 to v0.6.0 (v0.7.0 is outside it) - CVE-2022-41721: v0.1.0 (v0.2.0 is outside it) - CVE-2022-41717: v0.1.0 to v0.3.0 (v0.4.0 is outside it) - CVE-2022-27664: no published release is affected - CVE-2021-44716: no published release is affected - CVE-2021-31525: no published release is affected - CVE-2021-33194: no published release is affected - CVE-2019-9512: no published release is affected - CVE-2019-9514: no published release is affected - CVE-2018-17848: no published release is affected - CVE-2018-17847: no published release is affected - CVE-2018-17846: no published release is affected - CVE-2018-17143: no published release is affected - CVE-2018-17142: no published release is affected - CVE-2018-17075: no published release is affected ## Advisories (40) ### [CVE-2026-97045](https://cve.now/CVE-2026-97045): Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net - Severity: Medium 6.1 - Published: Oct 27, 2026 - Affected: fixed in 0.62.0. - Fixed in v0.62.0 (released Oct 27, 2026, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-78661](https://cve.now/CVE-2026-78661): Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net - Severity: High 7.5 - Published: Oct 27, 2026 - Affected: fixed in 0.62.0. - Fixed in v0.62.0 (released Oct 27, 2026, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-97032](https://cve.now/CVE-2026-97032): HTTP/2 server crash due to HPACK encoder race in net/http - Severity: High 7.5 - Published: Oct 8, 2026 - Affected: fixed in 0.60.0. - Fixed in v0.60.0 (released Oct 8, 2026, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-78663](https://cve.now/CVE-2026-78663): Double flow control refund on HTTP/2 server streams in net/http - Severity: Critical 9.1 - Published: Oct 8, 2026 - Affected: fixed in 0.60.0. - Fixed in v0.60.0 (released Oct 8, 2026, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-78669](https://cve.now/CVE-2026-78669): Excessive CPU consumption from repeated initial window changes in net/http - Severity: High 7.5 - Published: Oct 8, 2026 - Affected: fixed in 0.60.0. - Fixed in v0.60.0 (released Oct 8, 2026, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-78660](https://cve.now/CVE-2026-78660): HTTP/2 transport accepts malformed framing-related headers in net/http - Severity: High 7.5 - Published: Oct 8, 2026 - Affected: fixed in 0.60.0. - Fixed in v0.60.0 (released Oct 8, 2026, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-78659](https://cve.now/CVE-2026-78659): HTTP/2 server memory exhaustion due to Trailer headers in net/http - Severity: High 7.5 - Published: Oct 8, 2026 - Affected: fixed in 0.60.0. - Fixed in v0.60.0 (released Oct 8, 2026, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-46600](https://cve.now/CVE-2026-46600): Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage - Severity: High 7.5 - Published: Jul 21, 2026 - Affected: fixed in 0.56.0. - Fixed in v0.56.0 (released Jun 9, 2026, 42 days before disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-27136](https://cve.now/CVE-2026-27136): Invoking duplicate attributes can cause XSS in golang.org/x/net/html - Severity: Medium 6.1 - Published: May 22, 2026 - Affected: fixed in 0.55.0. - Fixed in v0.55.0 (released May 22, 2026, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-25681](https://cve.now/CVE-2026-25681): Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html - Severity: Medium 6.1 - Published: May 22, 2026 - Affected: fixed in 0.55.0. - Fixed in v0.55.0 (released May 22, 2026, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-25680](https://cve.now/CVE-2026-25680): Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html - Severity: Medium 6.5 - Published: May 22, 2026 - Affected: fixed in 0.55.0. - Fixed in v0.55.0 (released May 22, 2026, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-42502](https://cve.now/CVE-2026-42502): Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html - Severity: Medium 6.1 - Published: May 22, 2026 - Affected: fixed in 0.55.0. - Fixed in v0.55.0 (released May 22, 2026, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-39821](https://cve.now/CVE-2026-39821): Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna - Severity: Critical 9.6 - Published: May 22, 2026 - Affected: fixed in 0.55.0. - Fixed in v0.55.0 (released May 22, 2026, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-42506](https://cve.now/CVE-2026-42506): Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html - Severity: Medium 6.1 - Published: May 22, 2026 - Affected: fixed in 0.55.0. - Fixed in v0.55.0 (released May 22, 2026, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-33814](https://cve.now/CVE-2026-33814): Infinite loop in HTTP/2 transport when given bad SETTINGS\_MAX\_FRAME\_SIZE in net/http/internal/http2 in golang.org/x/net - Severity: High 7.5 - Published: May 7, 2026 - Affected: fixed in 0.53.0. - Fixed in v0.53.0 (released Apr 9, 2026, 28 days before disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2026-27141](https://cve.now/CVE-2026-27141): Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net - Severity: High 7.5 - Published: Feb 26, 2026 - Affected: from 0.50.0, fixed in 0.51.0. - Fixed in v0.51.0 (released Feb 25, 2026, 1 day before disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2025-58190](https://cve.now/CVE-2025-58190): Infinite parsing loop in golang.org/x/net - Severity: Medium 5.3 - Published: Feb 5, 2026 - Affected: fixed in 0.45.0. - Fixed in v0.45.0 (released Oct 7, 2025, 121 days before disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2025-47911](https://cve.now/CVE-2025-47911): Quadratic parsing complexity in golang.org/x/net/html - Severity: Medium 5.3 - Published: Feb 5, 2026 - Affected: fixed in 0.45.0. - Fixed in v0.45.0 (released Oct 7, 2025, 121 days before disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2025-22872](https://cve.now/CVE-2025-22872): Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net - Severity: Medium 6.5 - Published: Apr 16, 2025 - Affected: fixed in 0.38.0. - Fixed in v0.38.0 (released Mar 27, 2025, 20 days before disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2025-22870](https://cve.now/CVE-2025-22870): HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net - Severity: Medium 4.4 - Published: Mar 12, 2025 - Affected: fixed in 0.36.0. - Fixed in v0.36.0 (released Mar 4, 2025, 8 days before disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2024-45338](https://cve.now/CVE-2024-45338): Non-linear parsing of case-insensitive content in golang.org/x/net/html - Severity: Medium 5.3 - Published: Dec 18, 2024 - Affected: fixed in 0.33.0. - Fixed in v0.33.0 (released Dec 18, 2024, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2023-45288](https://cve.now/CVE-2023-45288): HTTP/2 CONTINUATION flood in net/http - Severity: High 7.5 - Published: Apr 4, 2024 - Affected: fixed in 0.23.0. - Fixed in v0.23.0 (released Apr 3, 2024, 1 day before disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2023-39325](https://cve.now/CVE-2023-39325): HTTP/2 rapid reset can cause excessive work in net/http - Severity: Unrated - Published: Oct 11, 2023 - Affected: fixed in 0.17.0. - Fixed in v0.17.0 (released Oct 10, 2023, 1 day before disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2023-44487](https://cve.now/CVE-2023-44487): The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as - Severity: High 7.5 · KEV - Published: Oct 10, 2023 - Affected: fixed in 0.17.0. - Fixed in v0.17.0 (released Oct 10, 2023, the day of disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2023-3978](https://cve.now/CVE-2023-3978): Improper rendering of text nodes in golang.org/x/net/html - Severity: Unrated - Published: Aug 2, 2023 - Affected: fixed in 0.13.0. - Fixed in v0.13.0 (released Aug 1, 2023, 1 day before disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2022-41723](https://cve.now/CVE-2022-41723): Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net - Severity: High 7.5 - Published: Feb 28, 2023 - Affected: fixed in 0.7.0. - Fixed in v0.7.0 (released Feb 14, 2023, 14 days before disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2022-41721](https://cve.now/CVE-2022-41721): Request smuggling due to improper request handling in golang.org/x/net/http2/h2c - Severity: High 7.5 - Published: Jan 13, 2023 - Affected: from 0.0.0-20220524220425-1d687d428aca, fixed in 0.1.1-0.20221104162952-702349b0e862. - Fixed in v0.2.0 (released Nov 7, 2022, 67 days before disclosure, the advisory names 0.1.1-0.20221104162952-702349b0e862, which was never published). - The latest release, v0.62.0, is not affected. ### [CVE-2022-41717](https://cve.now/CVE-2022-41717): Excessive memory growth in net/http and golang.org/x/net/http2 - Severity: Unrated - Published: Dec 8, 2022 - Affected: fixed in 0.4.0. - Fixed in v0.4.0 (released Dec 6, 2022, 2 days before disclosure). - The latest release, v0.62.0, is not affected. ### [CVE-2022-27664](https://cve.now/CVE-2022-27664): In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang… - Severity: Unrated - Published: Sep 6, 2022 - Affected: fixed in 0.0.0-20220906165146-f3363e06e74c. - Fixed in v0.1.0 (released Oct 19, 2022, 43 days after disclosure, the advisory names 0.0.0-20220906165146-f3363e06e74c, which was never published). - The latest release, v0.62.0, is not affected. ### [CVE-2021-44716](https://cve.now/CVE-2021-44716): net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via… - Severity: Unrated - Published: Jan 1, 2022 - Affected: fixed in 0.0.0-20211209124913-491a49abca63. - Fixed in v0.1.0 (released Oct 19, 2022, 291 days after disclosure, the advisory names 0.0.0-20211209124913-491a49abca63, which was never published). - The latest release, v0.62.0, is not affected. ### [CVE-2021-31525](https://cve.now/CVE-2021-31525): net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to… - Severity: Unrated - Published: May 27, 2021 - Affected: fixed in 0.0.0-20210428140749-89ef3d95e781. - Fixed in v0.1.0 (released Oct 19, 2022, 510 days after disclosure, the advisory names 0.0.0-20210428140749-89ef3d95e781, which was never published). - The latest release, v0.62.0, is not affected. ### [CVE-2021-33194](https://cve.now/CVE-2021-33194): golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted… - Severity: Unrated - Published: May 26, 2021 - Affected: fixed in 0.0.0-20210520170846-37e1c6afe023. - Fixed in v0.1.0 (released Oct 19, 2022, 511 days after disclosure, the advisory names 0.0.0-20210520170846-37e1c6afe023, which was never published). - The latest release, v0.62.0, is not affected. ### [CVE-2019-9512](https://cve.now/CVE-2019-9512): Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service - Severity: High 7.5 - Published: Aug 13, 2019 - Affected: fixed in 0.0.0-20190813141303-74dc4d7220e7. - Fixed in v0.1.0 (released Oct 19, 2022, 1163 days after disclosure, the advisory names 0.0.0-20190813141303-74dc4d7220e7, which was never published). - The latest release, v0.62.0, is not affected. ### [CVE-2019-9514](https://cve.now/CVE-2019-9514): Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service - Severity: High 7.5 - Published: Aug 13, 2019 - Affected: fixed in 0.0.0-20190813141303-74dc4d7220e7. - Fixed in v0.1.0 (released Oct 19, 2022, 1163 days after disclosure, the advisory names 0.0.0-20190813141303-74dc4d7220e7, which was never published). - The latest release, v0.62.0, is not affected. ### [CVE-2018-17848](https://cve.now/CVE-2018-17848): The html package (aka x/net/html) through 2018-09-25 in Go mishandles \\\\\, leading to a "panic: runtime… - Severity: Unrated - Published: Oct 1, 2018 - Affected: fixed in 0.0.0-20190125002852-4b62a64f59f7. - Fixed in v0.1.0 (released Oct 19, 2022, 1479 days after disclosure, the advisory names 0.0.0-20190125002852-4b62a64f59f7, which was never published). - The latest release, v0.62.0, is not affected. ### [CVE-2018-17847](https://cve.now/CVE-2018-17847): The html package (aka x/net/html) through 2018-09-25 in Go mishandles \\\\\\, leading to a "panic… - Severity: Unrated - Published: Oct 1, 2018 - Affected: fixed in 0.0.0-20190125002852-4b62a64f59f7. - Fixed in v0.1.0 (released Oct 19, 2022, 1479 days after disclosure, the advisory names 0.0.0-20190125002852-4b62a64f59f7, which was never published). - The latest release, v0.62.0, is not affected. ### [CVE-2018-17846](https://cve.now/CVE-2018-17846): The html package (aka x/net/html) through 2018-09-25 in Go mishandles \\\\\\, leading to an infinite… - Severity: Unrated - Published: Oct 1, 2018 - Affected: fixed in 0.0.0-20190125091013-d26f9f9a57f3. - Fixed in v0.1.0 (released Oct 19, 2022, 1479 days after disclosure, the advisory names 0.0.0-20190125091013-d26f9f9a57f3, which was never published). - The latest release, v0.62.0, is not affected. ### [CVE-2018-17143](https://cve.now/CVE-2018-17143): The html package (aka x/net/html) through 2018-09-17 in Go mishandles \\\, leading to a "panic: runtime… - Severity: Unrated - Published: Sep 17, 2018 - Affected: fixed in 0.0.0-20180921000356-2f5d2388922f. - Fixed in v0.1.0 (released Oct 19, 2022, 1493 days after disclosure, the advisory names 0.0.0-20180921000356-2f5d2388922f, which was never published). - The latest release, v0.62.0, is not affected. ### [CVE-2018-17142](https://cve.now/CVE-2018-17142): The html package (aka x/net/html) through 2018-09-17 in Go mishandles \\\\, leading to a "panic: runtime error"… - Severity: Unrated - Published: Sep 17, 2018 - Affected: fixed in 0.0.0-20180925071336-cf3bd585ca2a. - Fixed in v0.1.0 (released Oct 19, 2022, 1493 days after disclosure, the advisory names 0.0.0-20180925071336-cf3bd585ca2a, which was never published). - The latest release, v0.62.0, is not affected. ### [CVE-2018-17075](https://cve.now/CVE-2018-17075): The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for… - Severity: Unrated - Published: Sep 16, 2018 - Affected: fixed in 0.0.0-20180816102801-aaf60122140d. - Fixed in v0.1.0 (released Oct 19, 2022, 1494 days after disclosure, the advisory names 0.0.0-20180816102801-aaf60122140d, which was never published). - The latest release, v0.62.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/golang.org/x/net Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.